Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme

Size: px

Start display at page:

Download "Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme"

Arron Bryant
6 years ago
Views:

1 STO1960BU vsphere Encryption for Virtual Machines and vsan Encryption Deep Dive VMworld 2017 Content: Not for publication Jase McCarty & Mike Foley #VMworld #STO1960

2 Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. #STO1960BU CONFIDENTIAL 2

3 VMware Data At Rest Encryption Choices vsphere SAN VM Encryption NAS Shared Storage Storage vsan vsphere vsan Encryption vsan Datastore vsan 3

4 VM Encryption

5 VM Encryption Manageability Encryption managed via Storage Policies Scalable & Easy to Manage Encryption No modification within the Guest. VM Agnostic Guest OS VM Hardware version Datastore Independent NFS, iscsi, VMFS, vsan Encrypts both VMDK and VM files No access to encryption keys by the Guest Full support of Encrypted vmotion Encrypted VM = vmotion is ALWAYS encrypted Not Deduplication/Compression friendly 5

VM Encryption How it works HA Cluster VM Encryption Module VM Encryption Module VM Encryption Module ESXi ESXi ESXi DEK: XTS-AES-256 KEK: AES-256 VM Encryption Module IOIO IOIO IOIO ESXi *&* %*^ $&*(

6 VM Encryption How it works HA Cluster VM Encryption Module VM Encryption Module VM Encryption Module ESXi ESXi ESXi DEK: XTS-AES-256 KEK: AES-256 VM Encryption Module IOIO IOIO IOIO ESXi *&* %*^ $&*( vcenter 3 rd Party KMIP-Compliant KMS Previously encrypted VM - Data Encryption Key (DEK) is created by host. DEK encrypted with Key Encryption Key (KEK) from the KMS Encrypted VM is powered on vcenter requests KEK from Key Management Server Key Manager returns the KEK to vcenter which passes it to all hosts in an HA cluster (KEK is not persisted in vcenter!) KMIP-provided KEK used to decrypt DEK Hypervisor level Encryption and Decryption begins without Guest OS modification or knowledge! 6

7 VM Encryption ESXi Key Cache and HA behavior HA Cluster Key Cache Key Cache Key Cache 7

8 Data Encryption Key (DEK).vs. Key Encryption Key (KEK) KMS Cluster Alias and KEK key ID are stored with the VM vcenter reads encryption.keysafe to find out where to get the KEK scsi0:0.present = "TRUE" scsi0:0.redo = "" tools.synctime = "FALSE" extendedconfigfile = "Centos 7.vmxf" migrate.encryptionmode = "disabled" encryption.keysafe = "vmware:key/list/(pair/(fqid/<vmware- NULL>/KMS01/5,HMAC%2dSHA%2d256,MhtSNrQA8FC9DehrUiiw2SPjamJpfk5x5FNbYcvRgKpJFaWw7iHDeaxFBHLXAU8OQdVoSLJW%2f wosellr7ktx9etzlb63rssetceu%2banx4e2ighbybkjilnlwugabzmjjhqnl%2bl6jxl2fu5e8bm2dq%2boiezyn9rcqceoy8svdorg%3 d))" encryption.data = "k3oonxfhkgeg4vrsk+aeamuxpaobvbi4wwdr26vjkyb6+tjioizcbf7klpou3hcufopzmhsc7cguxwyoqcm2+fbhsu/huh1qkhomyrdwg nb05vll9n2e4/8pzhynwmmrwtv51exfuch6z9n0ivt0wcyvvxsfm/eohf2/l8+ef32/psnn8mmlt99652aespqn0mqduumwhj/fch8wvz9 /BFHbsXQoK1EHKt1gH5zmA/UDXhlYXC+E9TV4xgfI/ID8u48M7e5SuTdJumWPNcaO+1Y7LTuOzFc+iNJ5Y8yksLR8bLXYb3Bca19EZYcbz Dj6nEw0rQ8uyo4v7zd1WANBKEfvqm+F1qAE7bNl5p/MR8c=" VMworld 2017 Content: Not for publication DEK is stored with the VM and encrypted with the KEK provided by the KMS and stored in the ESXi key cache 8

9 UI Encrypt / Decrypt demo UI Enable-Disable Encryption video 9

VM Data is Protected by Customer Provided Key

Key Protected by customer s Key Management

Protected by a KMS Key Encryption Key VM Data

encrypted by the KMS provided KEK Only the

data! KMS Keys (KEK) do NOT persist in vcenter

10 VM Data is Protected by Customer Provided Key Encryption Keys KEK KMS provided Key Encryption Key Protected by customer s Key Management Server DEK - ESXi generated data encryption key Protected by a KMS Key Encryption Key VM Data Protected by an ESXi generated DEK that is encrypted by the KMS provided KEK Only the holder of the KMS provided key can access the VM data! KMS Keys (KEK) do NOT persist in vcenter Customers are responsible for managing the lifecycle of KMS keys! 10

11 vsan Encryption

12 Secure Data with Software Encryption for Data at Rest vsphere vsan Datastore vsan Protect against unauthorized access and transfer drives safely with software data-atrest encryption Set at the cluster level for simplified operations and rekeying for greater security Control costs and choice by selecting industry-standard flash or magnetic drives Support space efficiency features, like deduplication and compression Integrate with all major key management technologies that are KMIP 1.1 compliant

vsan Encryption Overview Encryption managed at the cluster level One-Click Datastore Encryption Encrypts entire vsan datastore All objects No modification within the Guest.

13 vsan Encryption Overview Encryption managed at the cluster level One-Click Datastore Encryption Encrypts entire vsan datastore All objects No modification within the Guest. VM Agnostic Guest OS HW Version No access to encryption keys by Guests Encryption Compatible with All-Flash or Hybrid architectures Dedupe/Compression only on All-Flash Requires Disk Format Change (DFC) and v5 On-Disk Format 13

14 vsan Encryption Setup vsphere vsan vsan Datastore KMS Connection Setup in vcenter KEK, Cluster KEK ID, HostKey created KMS Connection, Cluster KEK ID & Host Key pushed to hosts Rolling Disk Format Change Across Disk Groups KMS vsan is Encrypted 14

15 vsan Encryption - Ingesting Writes Disk Group Cache Tier Capacity Tier Write I/O broken into 64K chunks Checksum performed on 4K blocks Encryption performed on 2K blocks Lands in buffer Decrypt performed on 4K blocks Dedupe performed on 4K blocks Compression performed on 4K blocks Encryption performed on 2-4K blocks Lands in persistent tier (capacity) 15

vsan Encryption Rekey Operations Rekeying managed at the cluster level Simple Datastore Rekeying Shallow Rekey Key Encryption Keys (KEK) No impact to storage operations Automatically rekeyed from KMS

16 vsan Encryption Rekey Operations Rekeying managed at the cluster level Simple Datastore Rekeying Shallow Rekey Key Encryption Keys (KEK) No impact to storage operations Automatically rekeyed from KMS Deep Rekey Disk Encryption Keys (DEK) Disks can be re-encrypted Requires data evacuation from disk Rolling process similar to enabling/disabling encryption May need Reduced Redundancy Entirely dependent on Storage Policies 2 Node or 3 Node configurations 16

17 Cryptographic Operations Considerations

18 Common Libraries, Common Setup of KMS 18

New Role: No Cryptography Administrator Most of the same privileges as Administrator VM Operations Power On/Off Boot Shutdown vmotion vsan Operations Manage vsan normally Does not include any

19 New Role: No Cryptography Administrator Most of the same privileges as Administrator VM Operations Power On/Off Boot Shutdown vmotion vsan Operations Manage vsan normally Does not include any Cryptographic Operations No Encrypt / No Decrypt No Enabling/Disabling of vsan Encryption No Console Access to Encrypted virtual machines No ability to download encrypted VM s No ability to add hosts to vcenter 19

20 Encryption Nitty-Gritty Keys, Algorithms, etc. VM and vsan Encryption XTS-AES-256 length keys for data Key generated by the ESXi host Referred to as the Data Encryption Key or DEK AES-128 or AES-256 for key encryption Key generated by the KMS. Referred to as the Key Encryption Key or KEK KEK key length is configured on the KMS, not on vcenter vmotion Encryption keys Generated by vcenter, not KMS One Time Use Only! AES-256 key 64-bit Nonce 20

21 Key Management Configuration 21

22 Key Manager The next datacenter requirement Encryption is becoming pervasive Regulatory requirements for encryption are growing Key Manager availability is a business critical requirement Not unlike DNS or NTP! Plan like your life depends on this Do you have just one DNS server? No! What if it goes down? THAT is how you should plan key management! 22

23 Key Manager Topology KMS Cluster/Alias KMS A KMS B KMS C vsphere Datastore 23

24 Multi-Site Key Manager Topology Site A KMS Cluster/Alias KMS Cluster/Alias KMS A KMS B KMS CD KMS E KMS F vsphere VMworld 2017 Content: Not for vsphere Site B publication Datastore Datastore 24

25 Multi-Site Key Manager Topology Order is important Site A KMS Cluster /Alias Site B KMS-A KMS-B KMS-C KMS-D KMS-E KMS-F vsphere Datastore SITE A KMS Order KMS-A KMS-B KMS-C KMS-D KMS-E KMS-F SITE B KMS Order KMS-D KMS-E KMS-F KMS-A KMS-B KMS-C vsphere Datastore 25

26 Comparisons Between VM Encryption & vsan Encryption

VM Encryption & vsan Comparison Encryption

Point: One Key Per vsan Cluster distribution

Encryption Datastore Support: Any vsphere

27 VM Encryption & vsan Comparison Encryption Point: One Key Per VM Key Manger Support: Multiple via API vsphere SAN Encrypted vc/psc: Not Supported NAS Shared Storage Storage vsan vsphere Encrypted vc/psc: Supported vsan Datastore vsan or Encryption Point: One Key Per vsan Cluster distribution Key Manger Support: One per vsan Cluster VM Encryption Datastore Support: Any vsphere Datastore Datastore Support: vsan Datastore vsan Encryption 27

28 VM Encryption & vsan Encryption Use Cases Multi-Tenancy vsan VDI Tenant A Tenant C Tenant B Tenant D SAN NAS vsan vsan Storage Mobility Virtual Desktops VDI Deduplication & Compression

29 But what about performance?!?!?! It s not just the speed of encryption The speed of AES-NI (processor generation/model specific) Important to consider but not biggest factor How much and what type of I/O a VM is generating? How many encrypted VM s per host Storage infrastructure? Consider storage speed / bandwidth / protocol Different media types (HDD, SDD, NVME) each have a different impact on performance Initial Encryption vs. Steady State Understand your workloads, use vrops! VM Encryption: Existing vs. New Application Deployment Encrypt BEFORE installing OS & S/W! 29

VM Encryption Performance Whitepaper Performance Whitepaper Highlights Impact on I/O performance is minimal when using enterprise-class SSD or VMware vsan storage Locally attached NVME

30 VM Encryption Performance Whitepaper Performance Whitepaper Highlights Impact on I/O performance is minimal when using enterprise-class SSD or VMware vsan storage Locally attached NVME drives can introduce per-i/o latencies which could affect performance Storage layer has just as much if not more impact on total performance Encryption will introduce a high CPU utilization 30

31 PowerCLI Automation with VM & vsan Encryption VMworld 2017 Content: Not for publication

32 PowerCLI for VM Encryption: Disk encryption Tasks $vmname = Tiny #Encrypt a VM Get-VM -Name $vmname Enable-VMencryption #Shallow Re-Key of a VM Get-VM -Name $vmname Set-VMEncryptionKey -KMSClusterId NewKMS # Encrypt just the Home object $EP = Get-SpbmStoragePolicy -Name "Encryption Policy Get-VM -Name $vmname Enable-VMEncryption -Policy $EP -SkipHardDisks #Decrypt a VM Get-VM -Name $vmname Disable-VMencryption 32

33 PowerCLI for VM Encryption: Report on Encryption status 33

34 What KMS is providing the host keys? 34

35 PowerCLI: vsan Encryption Rekey Examples $Cluster = Get-Cluster -name Cluster # Get the vsan Cluster Configuration $VsanVcClusterConfig = Get-VsanView -Id VsanVcClusterConfigSystem-vsan-cluster-config-system # Perform a Deep Rekey $VsanVcClusterConfig.VsanEncryptedClusterRekey_Task($Cluster.ExtensionData.MoRef,$true,$false) # Perform a Shallow Rekey $VsanVcClusterConfig.VsanEncryptedClusterRekey_Task($Cluster.ExtensionData.MoRef,$false,$false) # Get vsan Cluster Encryption State $VsanVcClusterConfig.VsanClusterGetConfig($Cluster.ExtensionData.MoRef).DataEncryptionConfig 35

$\Vsan-EncryptionReport.ps1 -vcenter vcsa.vcorp.$

36 PowerCLI: vsan Encryption Report Sample.\Vsan-EncryptionReport.ps1 -vcenter vcsa.vcorp.com -Clustername 36

$\Vsan-EncryptionReport.ps1 -vcenter vcsa.vcorp.$

37 PowerCLI: vsan Encryption Report Sample.\Vsan-EncryptionReport.ps1 -vcenter vcsa.vcorp.com -Clustername 37

38 Summary

39 Summary Ease of Operations and Deployment PowerCLI and other API support for automation Ease of Manageability No change to individual virtual machine operating systems Common encryption solution across all virtual machines Flexibility Encrypt based on workload type and security requirements Choice Standards Based Key Management Secure AES-XTS-256 encryption using modules that are FIPS evaluated 39

40 Questions?

Other sessions to consider: #SER1361BU Security

Log Insight #SER1848BU vsphere Platform Security

Machines and vsan Encryption Deep Dive VMworld 2017

41 Other sessions to consider: #SER1361BU Security Operations for VMware vsphere with VMware vrealize Log Insight #SER1848BU vsphere Platform Security Update #STO1960BU vsphere Encryption for Virtual Machines and vsan Encryption Deep Dive VMworld 2017 Content: Not for publication #GRC2226BU Operate Clouds at Least Privilege

Current Issues

SER1848BE vsphere Platform Security Update Mike Foley Technical Market Architect vsphere Security Abhijat Singh Product Manager vsphere Security #VMworld #SER1848BE Current Issues Current Issues: SMB v1